The GPU gateway
For a deployment whose model runtime lives on a host this vault does not own — a shared GPU box, a departmental server, a proxy in front of several runtimes. If your runtime runs beside the vault in its own compose network, none of this applies and using a GPU for the models is the page you want.
Every obligation below is the HOST's, not the vault's. The vault presents what it is configured to present and refuses when it cannot; what the machine at the other end does with the request afterwards is outside anything a client can check. They are written down because a shared model host is the one piece of a SkyKeep deployment that can quietly hold a copy of the engagement.
Which roads this deployment actually has, and what each one presents, is on choosing the models under the roads out of this vault.
What a gateway is here, and what the vault can check
A gateway is any TLS endpoint you put a model runtime behind — one GPU host shared by several deployments, or a proxy in front of several runtimes. SkyKeep ships no such component and configures none: it dials the address you name for each road and presents the credential you configure for that road. Everything on the rest of this page happens at the OTHER end, which means the vault states it and cannot verify it. That is not a gap to be closed later — a client cannot check what a server does with a request after it has answered it. If the host belongs to somebody else, these are the things to get in writing before any document crosses.
What the vault presents, per road
One credential per road, never a shared one. Each road has its own scheme setting, its own secret file and its own acknowledgment, so a token issued for the answering host is not authority to send that host your images, and a certificate revoked on one road does not take the other five down with it. Under a certificate scheme the vault presents a client certificate and its private key, read from files named by that road's own settings: a key readable by its group or by the world is refused when the deployment starts, not warned about. A credential never travels in an address — it is a request header or a posted body, on every road, always. And a credential is never sent in cleartext to a host outside the deployment unless the operator has named that road's acknowledgment, because cleartext discloses the credential to every hop between here and there.
What the gateway must verify
TLS 1.2 or better, and a client it has actually identified. Where the vault presents a certificate the gateway must REQUIRE one, verify it against the authority that issued it, and check it has not been revoked — requesting a certificate and serving the request anyway when none arrives is the configuration that looks like mutual authentication and is not. A gateway that issues both a certificate and a token should bind them to each other, so a leaked token is useless from a machine that cannot complete the handshake. A request that fails any of these is refused, never downgraded to an anonymous one: the vault would rather see a refusal it can put in front of an operator than an answer nobody can account for.
What the gateway must never log
The content. Prompts, the document text inside them, the answers, the image bytes and the audio bytes are the vault's material, and a request log that keeps them is a second copy of the engagement sitting outside the vault with none of its compartment rules, none of its encryption and none of its audit trail. Log the fact of the call, the time, the client identity and the size; log no body. Tokens and private keys belong in no log at all, including a debug one that was going to be turned off later. If the runtime's default configuration writes prompts to a file — several do — that is the setting to change before the first document is ingested, not after.
Caching: off, or keyed to one vault
Prefix and prompt caching must be disabled, or keyed so that one deployment's cache can never be read by another's request. A shared cache across engagements is one engagement's prompts answering another engagement's question, which is exactly the separation compartments exist to hold — and it fails quietly, because a cache hit looks like a fast answer and not like a disclosure. On a host serving one deployment this costs nothing to get right; on a host serving several it is the first thing to check. <strong>The vault states its side on every call.</strong> It sends a prompt-cache key with each request, and the setting SKYKEEP_MODEL_PROMPT_CACHE decides how long that key lives: unset or `off` mints a NEW key per request, so a gateway that keys its cache has nothing to reuse; `keyed` sends one stable key for this vault, derived from SKYKEEP_MODEL_CACHE_IDENTITY, so this deployment reuses its own prefixes and no other deployment can touch them; `unrestricted` sends nothing and refuses to start without a typed acknowledgment. The key travels in a header (SKYKEEP_MODEL_CACHE_HEADER) and, for a gateway that reads it from the request body instead, in a field you name (SKYKEEP_MODEL_CACHE_FIELD — prompt_cache_key for OpenAI, cache_salt for vLLM). The identity itself never leaves the vault; only a digest of it does. None of this can MAKE a gateway honour the key: if the runtime ignores it, the obligation above is still entirely yours.
Rotation, and what it costs here
Certificates and tokens expire, and the schedule is the deployment's to set. The vault reads both from FILES rather than from environment values, which is what makes rotation cheap: replace the file and restart the vault — nothing is baked into an image, and no credential is visible to anybody who can inspect a running container. Revoke at the gateway as well as replacing at the vault; a certificate that is merely no longer used is still a certificate that works. Because each road carries its own credential, a rotation or a revocation is scoped to that road, and the other five keep running.
When the gateway says no
The vault refuses rather than retrying without the credential. A road configured with a scheme whose credential is missing, unreadable or rejected does not fall back to an anonymous call: an unauthenticated request to a host expecting one is at best a rejection somebody has to debug, and at worst — on a permissive host — a successful anonymous export of document content that nobody authorised. Under a session scheme the vault logs in once more and then stops. What an operator sees is a refusal that names the setting, which is the shape every configuration fault in this product takes.